uooplol[.]webflow[.]io

Analysis of uooplol.webflow.io confirms it as a brand-impersonation phishing site targeting Uphold, a digital finance platform. The domain, hosted on Cloudflare infrastructure (IP 172.64.151.8, AS13335), was flagged by 12 of 95 security vendors on VirusTotal and appears on the PhishDestroy blocklist. The page title, 'Uphold* Login : Where Digital Finance Meets Seamless Access,' directly mimics Uphold’s branding, aligning with the classified 'investment scam' threat type. The domain was created on May 8, 2013, and registered through MarkMonitor, Inc., though its use for malicious activity appears recent.

SSL certification is provided by Google Trust Services (WE1), and the site currently returns an HTTP 404 status, indicating it has been taken offline or disabled. Infrastructure analysis reveals Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) and HTTP/3 support, common among phishing domains leveraging CDN services to obscure hosting origins. While the domain’s registration predates its malicious use, defenders should treat it as part of a broader pattern of Uphold impersonation.

No evidence links this domain to other active campaigns, but the combination of brand-specific page titles, blocklist presence, and security vendor detections confirms its role in credential harvesting or fraudulent investment schemes. Organizations should block the domain at the DNS level, monitor for related subdomains on the webflow.io platform, and alert users to potential Uphold-themed phishing attempts. Further investigation into the hosting IP (172.64.151.8) may reveal additional malicious domains sharing the same infrastructure.